R Programming Language implementations are vulnerable to arbitrary code execution during deserialization of .rds and .rdx files

🗓️ 29 Apr 2024 00:00:00Reported by CERTType

Attackers exploit R language vulnerability to execute arbitrary code via .rds and .rdx files, potentially leading to unauthorized data access and system compromise

Reporter	Title	Published	Views	Family All 44
FreeBSD	R -- arbitrary code execution vulnerability	29 Apr 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed security vulnerabilities in JupyterHub, R Programming Language and Apache MINA (CVE-2024-28233, CVE-2024-27322, CVE-2019-0231, CVE-2021-41973)	27 Jun 202422:33	–	ibm
Tenable Nessus	Amazon Linux 2023 : libRmath, libRmath-devel, libRmath-static (ALAS2023-2024-638)	10 Jun 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : R (ALASR3.4-2024-001)	12 Jul 202400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : R (ALAS-2024-1940)	24 Jun 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: R (CVE-2024-27322)	10 Feb 202500:00	–	nessus
Tenable Nessus	Fedora 39 : R (2024-07b7b83a4f)	9 May 202400:00	–	nessus
Tenable Nessus	Fedora 38 : R (2024-bc590cb3f1)	9 May 202400:00	–	nessus
Tenable Nessus	FreeBSD : R -- arbitrary code execution vulnerability (4a1e2bad-0836-11ef-9fd2-1c697a616631)	2 May 202400:00	–	nessus
Tenable Nessus	GLSA-202412-01 : R: Arbitrary Code Execution	9 Dec 202400:00	–	nessus

Source	Link
cran	www.cran.r-project.org/doc/manuals/r-release/fullrefman.pdf
cran	www.cran.r-project.org/
hiddenlayer	www.hiddenlayer.com/research/r-bitrary-code-execution/

03 May 2024 16:07Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

EPSS0.04526

SSVC